Subprocessors
Last updated: May 11, 2026
Invest Check uses the third-party service providers listed below ("subprocessors") to operate the service. Each subprocessor processes personal information on Invest Check's behalf, under contract, and only for the limited purpose described for it. This page is referred to from our Privacy Policy and is the authoritative current list.
Current subprocessors
Vercel, Inc.
- Purpose:
- Application hosting, edge networking, request routing, aggregated analytics, and Web Vitals measurement. A Data Processing Addendum is published at https://vercel.com/legal/dpa.
- Data categories:
- IP address, request headers, user agent, session token (in transit), anonymised visit and performance metrics.
- Processing region:
- United States.
- Privacy notice:
- https://vercel.com/legal/privacy-policy
Neon, Inc.
- Purpose:
- Managed PostgreSQL database hosting.
- Data categories:
- All personal information stored by the service (account, sessions, purchase records, audit logs).
- Processing region:
- United States.
- Privacy notice:
- https://neon.tech/privacy-policy
Stripe, Inc.
- Purpose:
- Payment processing, subscription billing, fraud prevention, and tax computation where applicable.
- Data categories:
- Name, email, billing address, country, payment-card details (collected directly by Stripe), transaction metadata.
- Processing region:
- United States (with global processing).
- Privacy notice:
- https://stripe.com/privacy
Resend, Inc.
- Purpose:
- Delivery of transactional and (with consent) marketing email, including the daily trade digest. Provides bounce, complaint, and unsubscribe handling.
- Data categories:
- Recipient email address, message content, delivery and bounce events.
- Processing region:
- United States.
- Privacy notice:
- https://resend.com/legal/privacy-policy
Cloudinary Ltd.
- Purpose:
- Storage and delivery of images uploaded by Invest Check administrators (for example, trader avatars).
- Data categories:
- Uploaded image files.
- Processing region:
- United States.
- Privacy notice:
- https://cloudinary.com/privacy
PostHog Inc.
- Purpose:
- Product analytics: page views, custom events (profile views, checkout starts, purchases), and identified-user funnels. For visitors in the EEA, the United Kingdom, Switzerland, and Quebec, PostHog loads only after consent through our cookie banner.
- Data categories:
- IP address (truncated server-side), pseudonymous device identifier, page-view metadata, custom event properties, identified-user attributes (user id, email, name) once you sign in.
- Processing region:
- United States.
- Privacy notice:
- https://posthog.com/privacy
Google LLC (Google Workspace and Google sign-in)
- Purpose:
- Google Workspace hosts the Invest Check operational mailboxes (info@, legal@, privacy@, support@) and document collaboration for internal staff. Google sign-in (OAuth) is also offered as an optional authentication method; we use it only when you choose to authenticate with Google.
- Data categories:
- For Workspace: contents of email correspondence sent to or from Invest Check staff inboxes. For sign-in: email address, name, profile picture, OAuth tokens.
- Processing region:
- United States.
- Privacy notice:
- https://policies.google.com/privacy
DocuSign, Inc.
- Purpose:
- Electronic signature and government-issued identity verification for Featured Trader onboarding agreements. Used only for applicants applying to become a Featured Trader, not for ordinary subscriber accounts.
- Data categories:
- Applicant name, email, signature, copy of government-issued identification submitted for identity verification, and the executed Featured Trader agreement.
- Processing region:
- United States.
- Privacy notice:
- https://www.docusign.com/company/privacy-policy
Cross-border transfers
All subprocessors above process personal information on servers located outside Canada, primarily in the United States. As a result, personal information may be subject to the laws of those jurisdictions, including lawful access by foreign authorities. Each subprocessor is engaged under contract terms that require a level of protection comparable to what is required under Canadian privacy law. For transfers from the EEA, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (or their UK and Swiss equivalents) as the lawful transfer mechanism, supplemented by appropriate technical and organisational measures.
Changes to this list
We may add or replace subprocessors from time to time as the service evolves. When that happens, we update this page. For material additions — for example, a new analytics or AI provider that processes a meaningful new category of personal information — we will provide reasonable advance notice through the service or by email before the change takes effect.
Contact
Questions about this list, or about how a particular subprocessor handles your personal information, can be sent to legal@investcheck.com.